[Starlingx-discuss] calicoctl / calico containers stx 6.0 aio duplex and wireguard - DONE!

[Embedded Devel]

So literally after all the research I did on wireguard and a working model, 
in the dev lab, now i go to put it in production
only to discover stx 6.0 has now literally disabled wireguard in the 
kernel, months of time and research is now wasted.

I even mentioned it back in september and was told to file a bug report on 
previous errors with wireguard loading, then 
a later pre 6.0 appeared to have it fixed, and now i find in 6.0 ...

# CONFIG_WIREGUARD is not set

completely useless waste of time as well as when you upgraded mellanox 
drivers to the latest version rendering thousands of $s in
hardware useless to us for future revisions of starlingX, im sorry but i 
really have to say Ive gotten to the point where i ask why i bother
supporting stx, championing stx, and deploying it for clients, Im sorry but 
i am beyond fscking pissed off right now!


On Thursday 30 September 2021 11:41:20 AM (+07:00), Embedded Devel wrote:

 > LOL Achievement unlocked ... it works now
 > steps to reproduce:
 > controller-0:~$ wget 
https://centos.pkgs.org/7/epel-testing-x86_64/wireguard-tools-1.0.20210914-1.el7.x86_64.rpm.html
 
>
 > controller-0:~$ sudo yum install -y 
wireguard-tools-1.0.20210914-1.el7.x86_64.rpm Loaded plugins: fastestmirror
 > Examining wireguard-tools-1.0.20210914-1.el7.x86_64.rpm: 
wireguard-tools-1.0.20210914-1.el7.x86_64
 > Marking wireguard-tools-1.0.20210914-1.el7.x86_64.rpm to be installed
 > Resolving Dependencies
 > --> Running transaction check
 > ---> Package wireguard-tools.x86_64 0:1.0.20210914-1.el7 will be 
installed
 > --> Finished Dependency Resolution
 >
 > Dependencies Resolved
 >
 > 
===============================================================================================================================================================
 
> Package Arch Version Repository Size
 > 
===============================================================================================================================================================
 
>
 > Installing:
 > wireguard-tools x86_64 1.0.20210914-1.el7 
/wireguard-tools-1.0.20210914-1.el7.x86_64 291 k
 >
 > Transaction Summary
 > 
===============================================================================================================================================================
 
>
 > Install 1 Package
 >
 > Total size: 291 k
 > Installed size: 291 k
 > Downloading packages:
 > Running transaction check
 > Running transaction test
 > Transaction test succeeded
 > Running transaction
 > Installing : wireguard-tools-1.0.20210914-1.el7.x86_64 1/1 Verifying : 
wireguard-tools-1.0.20210914-1.el7.x86_64 1/1
 > Installed:
 > wireguard-tools.x86_64 0:1.0.20210914-1.el7
 > controller-0:~$ curl -o kubectl-calico -O -L 
"https://github.com/projectcalico/calicoctl/releases/download/v3.19.1/calicoctl"
 
> % Total % Received % Xferd Average Speed Time Time Time Current
 > Dload Upload Total Spent Left Speed
 > 100 615 100 615 0 0 1930 0 --:--:-- --:--:-- --:--:-- 1933
 > 100 42.8M 100 42.8M 0 0 28.1M 0 0:00:01 0:00:01 --:--:-- 46.2M
 > controller-0:~$ chmod +x kubectl-calico
 > controller-0:~$ sudo mv kubectl-calico /bin/
 > controller-0:~$ kubectl calico patch felixconfiguration default 
--type='merge' -p '{"spec":{"wireguardEnabled":true}}'
 > Successfully patched 1 'FelixConfiguration' resource
 >
 > controller-0:~$ sudo wg
 > interface: wireguard.cali
 > public key: LcaQ5thd7yo4thPR/d0g4LHCnWwEfVsLJaaveeQnago=
 > private key: (hidden)
 > listening port: 51820
 > fwmark: 0x100000
 >
 > peer: n1+ugi4bv8Vfpnhfau7/Uaqm/9RqhmQnQ9U+7DoOsj8=
 > endpoint: 192.168.206.3:51820
 > allowed ips: 172.16.166.128/26, 172.16.166.128/32, 172.16.166.163/32
 > controller-0:~$
 > controller-1:~$ sudo wg
 > interface: wireguard.cali
 > public key: n1+ugi4bv8Vfpnhfau7/Uaqm/9RqhmQnQ9U+7DoOsj8=
 > private key: (hidden)
 > listening port: 51820
 > fwmark: 0x100000
 >
 > peer: LcaQ5thd7yo4thPR/d0g4LHCnWwEfVsLJaaveeQnago=
 > endpoint: 192.168.206.2:51820
 > allowed ips: 172.16.192.64/32, 172.16.192.64/26, 172.16.192.87/32
 > controller-1:~$
 >
 >
 >
 > On Thursday 30 September 2021 11:11:01 AM (+07:00), Embedded Devel 
wrote:
 >
 > > based on the calico documentation, 
https://docs.projectcalico.org/security/encrypt-cluster-pod-traffic we 
should be able to patch felix calicoctl patch felixconfiguration default 
--type='merge' -p '{"spec":{"wireguardEnabled":true}}'
 > >
 > > I have a pre-6 stx aio duplex deployed, wireguard does work, i yum 
installed wireguard-tools, i can bring up the wg interface
 > >
 > > so two things, how can we execute calico commands ? i see 0 
documentation on it
 > >
 > > and two im curious what wireguard firewall rules for calico would look 
like.
 > >
 > > id imagine based on the docs
 > >
 > > cat <<EOF > gnp-oam-overrides.yaml
 > > apiVersion: crd.projectcalico.org/v1
 > > kind: GlobalNetworkPolicy
 > > metadata:
 > > name: wg-oam-overrides
 > > spec:
 > > ingress:
 > > - action: Allow
 > > destination:
 > > ports:
 > > - 51820
 > > protocol: UDP
 > > order: 500
 > > selector: has(iftype) && iftype == 'oam'
 > > types:
 > > - Ingress
 > > EOF
 > >
 > >
 > > when applied, i cannot connect a remote client to the OAM address, or 
the floating address
 > >

-- 
Sent with Vivaldi Mail. Download Vivaldi for free at vivaldi.com